Inconsistent value for runner.temp when running in a container

[aibaars]

Describe the bug

It appears #1762 only partly fixed the problem. Looking at a failed run https://github.com/github/codeql/actions/runs/4442367661/jobs/7798560621 the variable runner.temp is expanded with two different values.

In the following workflow snippet:

    runs-on: ubuntu-latest
    container:
      image: centos:centos7
    steps: 
      - name: Download Ruby bundle
        uses: actions/download-artifact@v3
        with:
          name: codeql-ruby-bundle
          path: ${{ runner.temp }}
      - name: Unzip Ruby bundle
        shell: bash
        run: unzip -q -d "${{ runner.temp }}/ruby-bundle" "${{ runner.temp }}/codeql-ruby-bundle.zip"

The use of path: ${{ github.temp }} in the with: clause of the download step was expanded correctly:

  with:
    name: codeql-ruby-bundle
    path: /home/runner/work/_temp

but the variable was expanded wrongly in the run: step.

unzip -q -d "/home/runner/work/_temp/ruby-bundle" "/home/runner/work/_temp/codeql-ruby-bundle.zip"

Expected behavior
All uses of the runner.temp variable inside the steps should be expanded to same value. The same for any of the other folder related variables.

Runner Version and Platform

Version of your runner?
'2.303.0'

OS of the machine running the runner?
Linux

What's not working?

Job fails with a "file not found" error message.

Job Log Output

If applicable, include the relevant part of the job / step log output here. All sensitive information should already be masked out, but please double-check before pasting here.

23s
0s
Run actions/download-artifact@v3
/usr/bin/docker exec  738c06c08904026388[1](https://github.com/github/codeql/actions/runs/4442367661/jobs/7798560621#step:6:1)a29ebc5944bd1ae51256[8](https://github.com/github/codeql/actions/runs/4442367661/jobs/7798560621#step:6:9)[9](https://github.com/github/codeql/actions/runs/4442367661/jobs/7798560621#step:6:10)97cdb84589427445afc1e39 sh -c "cat /etc/*release | grep ^ID"
Starting download for codeql-ruby-bundle
Directory structure has been setup for the artifact
Total number of files that will be downloaded: 1
Artifact codeql-ruby-bundle was downloaded to /__w/_temp
Artifact download has finished successfully
0s
Run unzip -q -d "/home/runner/work/_temp/ruby-bundle" "/home/runner/work/_temp/codeql-ruby-bundle.zip"
unzip:  cannot find or open /home/runner/work/_temp/codeql-ruby-bundle.zip, /home/runner/work/_temp/codeql-ruby-bundle.zip.zip or /home/runner/work/_temp/codeql-ruby-bundle.zip.ZIP.
Error: Process completed with exit code 9.

[nikola-jokic]

Hey @aibaars,

We turned off the feature flag for the PR #1762 because the hashFiles used translated paths while executing from the host.
We are sorry this is causing you problems, and we are trying to find the best way to fix it.
I will close this issue, since it is referring to the same issue as #2185

[aibaars]

I will close this issue, since it is referring to the same issue as #2185

@nikola-jokic I disagree that this issue is a duplicate of #2185. My problem is that runner.temp is sometimes expanded to the host path and sometimes to the container path. Issue #2185 is about the runner expanding to the wrong value, while this issue is about the runner behaving inconsistently.

Feel free to keep this issue closed, but please make sure the inconsistency is address as part of #2185.

[nikola-jokic]

Maybe I'm not seeing something correctly but they both expanded to the same value right?

The value in runner.temp: /home/runner/work/_temp
The path in with becomes /home/runner/work/_temp, and the value in unzip -q -d "/home/runner/work/_temp/ruby-bundle" which is ${{ runner.temp }}/ruby-bundle.
The issue I was referring to is that I thought it should be translated within the container.
The runner context does not consult the StepHost here, so it gets the host path instead of container path

[aibaars]

There are three uses of ${{ runner.temp }} in the example. The two in the run: field get expanded to the host path, however, the one in the actions/download-artifact step gets expanded to the container path. See the log line

Artifact codeql-ruby-bundle was downloaded to /__w/_temp

I should have simplified the example to have only 2 uses of the variable instead of 3; apologies if this confused you.

[nikola-jokic]

I think that happened because it got exposed as an env probably
I'll dig into that to confirm, but essentially, all envs are translated in the later stage

[aibaars]

Ah so what happens is path: ${{ runner.temp }} becomes something like INPUT_PATH=/home/runner/work/_temp, which subsequently gets rewritten to INPUT_PATH=/__w/_temp when supplying -e flags to the docker command.

[nikola-jokic]

Exactly 😄 Envs are getting translated for sure
I think you can leverage env instead of template to get the container path: RUNNER_TEMP for example
That one will get translated for sure

[aibaars]

Yes indeed, we already switched to RUNNER_TEMP which worked as expected.

Thanks for helping me understand what it going on. In the end the expansion is not inconsistent. It's just the way how action inputs are translated to environment variables that made it look like there was an inconsistency.

[clowa]

Hi @aibaars / @nikola-jokic , it sounds like you solved this issue by using an environment variable instead of the template runner.temp - any change you can share your solution with the community? I would be interested as well. Unfortunately I wasn't able to figure out how you solved this on my own.